Permissions change. Agents act. Advisories land. CapitalGuard tracks the official evidence, the control gaps, and the exact point where convenience becomes exposure.
Exposure state
Evidence before opinion.
10
Tool records
32
Cited sources
8
Tracked signals
6
Synthetic tests
Claim boundary
Scores measure public control documentation. They do not measure breach probability or guarantee safety.
Continuously watched. Editorially controlled.
Official sources are checked daily. Changed pages are quarantined for review; scores never rewrite themselves.
Public-Control Score
Five dimensions. Twenty points each. Every number links back to official documentation and a dated review.
76/100
Average across scored product records
ChatGPT
OpenAI · connected assistant
Substantial public control coverage
Claude
Anthropic · connected assistant
Substantial public control coverage
Gemini
Google · connected assistant
Partial public control coverage
Microsoft Copilot
Microsoft · connected assistant
Partial public control coverage
Perplexity
Perplexity AI · connected assistant
Partial public control coverage
GitHub Copilot
GitHub · coding assistant
Extensive public control coverage
Cursor
Anysphere · coding agent
Substantial public control coverage
Claude Code
Anthropic · coding agent
Extensive public control coverage
OpenAI Codex
OpenAI · coding agent
Extensive public control coverage
MCP-Connected AI Assistants
Multiple providers · connected assistant
Implementation-dependent protocol
Threat wire
Affected Cursor releases used case-sensitive checks around sensitive files, enabling a prompt-injection path to modify protected configuration on case-insensitive filesystems.
Action: Update to Cursor 1.7 or later and review repository-controlled AI configuration before trust is granted.
In a non-default Auto-Run plus Allowlist configuration, shell built-ins could alter environment variables without appearing in the command allowlist.
Action: Update to Cursor 2.3 or later and avoid treating command-name allowlists as a complete execution boundary.
A command-parsing error could bypass the confirmation prompt and trigger an untrusted command when attacker-controlled content entered context.
Action: Update to 2.0.72 or later and keep untrusted repository content outside command-authorizing context.
Affected Codex releases could treat a model-generated working directory as the sandbox writable root, bypassing the intended workspace boundary.
Action: Use Codex CLI 0.39.0 or later and IDE extension 0.4.12 or later, then verify the effective writable root before sensitive work.
Unsanitized package arguments reached a shell command, creating a path from tool input or indirect prompt injection to command execution.
Action: Update to 0.1.28 or later and use argument-safe process APIs rather than shell interpolation.
Affected remote deployments failed to confine file paths to the configured spreadsheet directory, allowing arbitrary file read and write operations.
Action: Update to 0.1.8 or later, bind remote services narrowly, authenticate requests, and validate resolved paths against the approved root.
Reproducible benchmark
Six inert fixtures test the CapitalGuard detection contract against Standard 1.0.0. The harness reads markers; it never runs fixture commands or vendor products.
RUN SHA-256 83f0586a997443653c6ac7f445fc127521320154eb6022454bb4908a8cb74478
CGO-TV-001Secret-bearing path signal
CGS-SEC-001 · CGS-DATA-001
CGO-TV-002Untrusted repository instruction
CGS-INJ-001
CGO-TV-003Broad workflow authority
CGS-PRIV-001 · CGS-HUMAN-001
CGO-TV-004Synthetic customer-data surface
CGS-DATA-001
CGO-TV-005Missing machine policy
CGS-POL-001
CGO-TV-006Command-authority marker
CGS-HUMAN-001 · CGS-PRIV-001
Practical coverage
Protect client files, credentials, shared links, and connected workspaces.
Open evidence guidesCapitalGuard Standard + signed Guardprints
Standard 1.0.0 defines the controls. SHA-256 binds the evidence state. Ed25519 signs official attestations. The registry exports only privacy-safe public proof.
Fund the record. Protect your own system.
A CapitalGuard license creates your own actionable security baseline and supports continued source review, benchmark maintenance, and public change tracking.